American Radio Relay League cyberattack takes Logbook of the World offline
The?American Radio Relay League (ARRL) warns it suffered a cyberattack, which disrupted its IT systems and online operations, including email and the Logbook of the World.
ARRL is the national association?for amateur radio in the United States, representing amateur radio interests to government regulatory bodies, providing technical advice, and promoting events and educational programs for enthusiasts around the country.
On Thursday, the ARRL announced that it suffered a cyberattack that disrupted its network and systems, including various online services hosted by the organization.
"We are in the?process of responding to a serious incident involving access to our network and headquarters-based systems. Several services, such as Logbook of The World?and the ARRL Learning Center, are affected," explained ARRL in a?.
Amateur radio enthusiasts use three-letter codes that start with the letter Q, which are called?, and they act as abbreviations for commonly used phrases in ham radio.
For example, the code QSO is shorthand for "I can communicate with _________?direct," and is used to denote a direct conversation between two stations. At the same time, QSL means "I am acknowledging receipt," meaning that?contact is confirmed.
Logbook of The World (LoTW) is an online database that allows amateur?radio enthusiasts to submit electronic logs of successful contacts (QSO) and confirmations (QSL)?between other users?worldwide. Enthusiasts can use these logs of successful communication on LoTW towards?.
In a Friday update, the ARRL took steps to allay members' concerns?about the security of their data, confirming that they do not store credit card information or collect social security numbers.
However, the organization confirmed that its member database contains some private information, including names, addresses, and call signs. While they do not specifically state email addresses are stored in the database, one is required to become a member of the organization.
It is unknown if the organization suffered a ransomware attack or another cybersecurity incident.
BleepingComputer contacted the ARRL with further questions, but?a reply was not immediately received.
KB?DCO Thomas Gagnon Sent from my IPAD 4th Gen. Air Touch
On Sun, May 19, 2024 at 11:02?AM KB?DCO Thomas via <Kb0dco=[email protected]> wrote:
Hello Everyone,
During the W?CRC Club Picnic… I was having issues logging into LOTW. I tried again today to log in there, but I’m still unsuccessful in doing so.
If you’re doing FT8 or having auto updates to LOTW… I would double check that you most recent contacts got uploaded after LOTW has been restored to normal operation.
Here is what I found on the ARRL website:?
ARRL Systems Service Disruption
05/17/2024
Updated 5/17/2024
Some members have asked whether their personal information has been compromised in some way. ARRL does not store credit card information anywhere on our systems, and we do not collect social security numbers. Our member database only contains publicly available information like name, address, and call sign along with ARRL specific data like email preferences and membership dates.
Original story below: 5/16/2024
We are in the process of responding to a serious incident involving access to our network and headquarters-based systems. Several services, such as Logbook of The World? and the ARRL Learning Center, are affected. Please know that restoring access is our highest priority, and we are expeditiously working with outside industry experts to address the issue. We appreciate your patience.
KB?DCO Thomas Gagnon Sent from my IPAD 4th Gen. Air Touch
We are writing to inform you of a serious incident that has impacted ARRL’s operations. On or around May 12, 2024, ARRL was the victim of a sophisticated network attack by a malicious international cyber group. We immediately involved the FBI and engaged with third party experts to investigate.
?
On May 16, on the eve of the ARRL National Convention in Ohio, we posted a notice on our website to inform members about the incident. Since then, we have made substantial progress to mitigate the impact of this attack on our organization. We have been posting regular updates, including the status of restored services. Please refer to our dedicated news post at?.
?
We are aware that certain members believe we should be openly communicating everything associated with this incident. We are working with industry experts, including cyber crime attorneys and the authorities, who have directed us to be conservative and cautious with our communications while restoring the ARRL network.
?
Many of our services and programs have been impacted by this attack. We have been diligently assessing each system to ascertain the extent of compromise. For example, while the Logbook of The World? server and related user data were unaffected, we have taken the precautionary measure of keeping the service offline until we can ensure the security and integrity of our networks. Similarly, access to Online DXCC is unavailable, although individual award data remains secure.
?
Fortunately, some of our key systems, such as the ARRL website and our association membership system, were unaffected. Despite the severity of the attack, no personal information was compromised. Additionally, ARRL does not store credit card information anywhere on our systems, and we do not collect social security numbers.
?
Our Directors have heard from some members who are concerned about managing their membership renewals.?Members can renew online at??or by phoning ARRL.
?
We understand the frustration and inconvenience this incident has caused, and we sincerely appreciate your patience and understanding as our dedicated staff and partners continue to work tirelessly to restore affected systems and services.
?
Thank you for your ongoing support.
?
Copyright ? 2024 American Radio Relay League, Incorporated. Use and distribution of this publication, or any portion thereof, is permitted for non-commercial or educational purposes, with attribution. All other purposes require written permission.
Effective 12:00pm ET / 16:00 UTC we will be returning Logbook of The World? (LoTW?) to service.
?
As work progressed on the network, some users encountered LoTW opening briefly during which some 6600 logs were uploaded. The logs were not processed until this weekend as we tested that the interfaces to LoTW were functioning properly.
We are taking steps to help manage what will likely be a huge influx of logs. We are requesting that if you have large uploads, perhaps from contests or from a DXpedition, please wait a week or two before uploading to give LoTW a chance to catch up. We have also implemented a process to reject logs with excessive duplicates. Please do not upload your entire log to “ensure” your contacts are in LoTW as they will be rejected. Lastly, please do not call ARRL Headquarters to report issues you are having with LoTW. You can contact support at LoTW-help@....
?
Through the end of the year, you may experience planned times when LoTW will be unavailable. We have been using this time to evaluate operational and infrastructure improvements we would like to make to LoTW. Those times will be announced.
We appreciate your patience as we worked through the challenges keeping LoTW from returning to service. We know the importance of LoTW to our members, and to the tens of thousands of LoTW users who are not ARRL members. LoTW, just behind QST, is our second most popular ARRL benefit.
?
?
Copyright ? 2024 American Radio Relay League, Incorporated. Use and distribution of this publication, or any portion thereof, is permitted for non-commercial or educational purposes, with attribution. All other purposes require written permission.
W0AYE Ben Wussow